Taehee Yoo 9beceb54fa netfilter: x_tables: Fix use-after-free in ipt_do_table. ... If verdict is NF_STOLEN in the SYNPROXY target, the skb is consumed. However, ipt_do_table() always tries to get ip header from the skb. So that, KASAN triggers the use-after-free message. We can reproduce this message using below command. # iptables -I INPUT -p tcp -j SYNPROXY --mss 1460 [ 193.542265] BUG: KASAN: use-after-free in ipt_do_table+0x1405/0x1c10 [ ... ] [ 193.578603] Call Trace: [ 193.581590] <IRQ> [ 193.584107] dump_stack+0x68/0xa0 [ 193.588168] print_address_description+0x78/0x290 [ 193.593828] ? ipt_do_table+0x1405/0x1c10 [ 193.598690] kasan_report+0x230/0x340 [ 193.603194] __asan_report_load2_noabort+0x19/0x20 [ 193.608950] ipt_do_table+0x1405/0x1c10 [ 193.613591] ? rcu_read_lock_held+0xae/0xd0 [ 193.618631] ? ip_route_input_rcu+0x27d7/0x4270 [ 193.624348] ? ipt_do_table+0xb68/0x1c10 [ 193.629124] ? do_add_counters+0x620/0x620 [ 193.634234] ? iptable_filter_net_init+0x60/0x60 [ ... ] After this patch, only when verdict is XT_CONTINUE, ipt_do_table() tries to get ip header. Also arpt_do_table() is modified because it has same bug. Signed-off-by: Taehee Yoo <ap420073@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>		2017-07-31 20:24:09 +02:00
..
netfilter	netfilter: x_tables: Fix use-after-free in ipt_do_table.	2017-07-31 20:24:09 +02:00
af_inet.c	net: convert sock.sk_wmem_alloc from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
ah4.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2017-06-23 14:17:31 -04:00
arp.c	networking: make skb_put & friends return void pointers	2017-06-16 11:48:39 -04:00
cipso_ipv4.c	net, ipv4: convert cipso_v4_doi.refcount from atomic_t to refcount_t	2017-07-04 01:29:04 -07:00
datagram.c
devinet.c	net: convert in_device.refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
esp4_offload.c	esp4/6: Fix GSO path for non-GSO SW-crypto packets	2017-04-19 07:48:57 +02:00
esp4.c	net: convert sock.sk_wmem_alloc from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
fib_frontend.c	mpls: fix rtm policy in mpls_getroute	2017-07-05 09:04:32 +01:00
fib_lookup.h	net: add extack arg to lwtunnel build state	2017-05-30 11:55:32 -04:00
fib_notifier.c	ipv4: fib: Remove redundant argument	2017-03-10 09:45:09 -08:00
fib_rules.c	ipv4: fib_rules: Dump FIB rules when registering FIB notifier	2017-03-16 10:18:34 -07:00
fib_semantics.c	net, ipv4: convert fib_info.fib_clntref from atomic_t to refcount_t	2017-07-04 01:29:04 -07:00
fib_trie.c	net, ipv4: convert fib_info.fib_clntref from atomic_t to refcount_t	2017-07-04 01:29:04 -07:00
fou.c	fou: make local function static	2017-05-21 13:42:36 -04:00
gre_demux.c
gre_offload.c
icmp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-06-15 11:59:32 -04:00
igmp.c	net: convert ip_mc_list.refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
inet_connection_sock.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
inet_diag.c
inet_fragment.c	net: convert inet_frag_queue.refcnt from atomic_t to refcount_t	2017-07-01 07:39:09 -07:00
inet_hashtables.c	net: make sk_ehashfn() static	2017-07-03 03:29:14 -07:00
inet_timewait_sock.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
inetpeer.c	net: convert inet_peer.refcnt from atomic_t to refcount_t	2017-07-01 07:39:07 -07:00
ip_forward.c
ip_fragment.c	net: convert inet_frag_queue.refcnt from atomic_t to refcount_t	2017-07-01 07:39:09 -07:00
ip_gre.c	net: add netlink_ext_ack argument to rtnl_link_ops.validate	2017-06-26 23:13:22 -04:00
ip_input.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
ip_options.c
ip_output.c	ipv4: ip_do_fragment: fix headroom tests	2017-07-15 14:38:31 -07:00
ip_sockglue.c	do_ip_setsockopt(): don't open-code memdup_user()	2017-06-30 02:04:09 -04:00
ip_tunnel_core.c	net: store port/representator id in metadata_dst	2017-06-25 11:42:01 -04:00
ip_tunnel.c	ip_tunnel: fix potential issue in ip_tunnel_rcv	2017-06-16 12:01:29 -04:00
ip_vti.c	net: add netlink_ext_ack argument to rtnl_link_ops.validate	2017-06-26 23:13:22 -04:00
ipcomp.c
ipconfig.c	networking: convert many more places to skb_put_zero()	2017-06-16 11:48:35 -04:00
ipip.c	net: add netlink_ext_ack argument to rtnl_link_ops.validate	2017-06-26 23:13:22 -04:00
ipmr.c	net: ipmr: ipmr_get_table() returns NULL	2017-07-12 08:18:46 -07:00
Kconfig
Makefile	tcp: ULP infrastructure	2017-06-15 12:12:40 -04:00
netfilter.c
ping.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
proc.c	tcp: add TCPMemoryPressuresChrono counter	2017-06-08 11:26:19 -04:00
protocol.c	net: Add sysctl to toggle early demux for tcp and udp	2017-03-24 13:17:07 -07:00
raw_diag.c
raw.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
route.c	net: remove DST_NOCACHE flag	2017-06-17 22:54:01 -04:00
syncookies.c	ipv4: ipv6: initialize treq->txhash in cookie_v[46]_check()	2017-07-18 11:22:51 -07:00
sysctl_net_ipv4.c	tcp: ULP infrastructure	2017-06-15 12:12:40 -04:00
tcp_bbr.c	tcp_bbr: init pacing rate on first RTT sample	2017-07-15 14:43:29 -07:00
tcp_bic.c	tcp: bic, cubic: use tcp_jiffies32 instead of tcp_time_stamp	2017-05-17 16:06:01 -04:00
tcp_cdg.c	sched/headers: Prepare for new header dependencies before moving code to <linux/sched/clock.h>	2017-03-02 08:42:27 +01:00
tcp_cong.c	bpf: Add support for changing congestion control	2017-07-01 16:15:14 -07:00
tcp_cubic.c	tcp: bic, cubic: use tcp_jiffies32 instead of tcp_time_stamp	2017-05-17 16:06:01 -04:00
tcp_dctcp.c
tcp_diag.c
tcp_fastopen.c	bpf: Add TCP connection BPF callbacks	2017-07-01 16:15:14 -07:00
tcp_highspeed.c
tcp_htcp.c	tcp: replace misc tcp_time_stamp to tcp_jiffies32	2017-05-17 16:06:01 -04:00
tcp_hybla.c
tcp_illinois.c
tcp_input.c	bpf: Add support for changing congestion control	2017-07-01 16:15:14 -07:00
tcp_ipv4.c	tcp: md5: tcp_md5_do_lookup_exact() can be static	2017-07-06 10:54:15 +01:00
tcp_lp.c	tcp: switch TCP TS option (RFC 7323) to 1ms clock	2017-05-17 16:06:01 -04:00
tcp_metrics.c	tcp: use tcp_jiffies32 to feed tp->snd_cwnd_stamp	2017-05-17 16:06:01 -04:00
tcp_minisocks.c	bpf: Support for setting initial receive window	2017-07-01 16:15:13 -07:00
tcp_nv.c	tcpnv: do not export local function	2017-05-21 13:42:36 -04:00
tcp_offload.c	net: convert sock.sk_wmem_alloc from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
tcp_output.c	net: reflect mark on tcp syn ack packets	2017-07-04 01:46:10 -07:00
tcp_probe.c
tcp_rate.c	tcp: export do_tcp_sendpages and tcp_rate_check_app_limited functions	2017-06-15 12:12:40 -04:00
tcp_recovery.c	tcp: switch TCP TS option (RFC 7323) to 1ms clock	2017-05-17 16:06:01 -04:00
tcp_scalable.c
tcp_timer.c	tcp: fix TCP_SYNCNT flakes	2017-05-24 16:29:57 -04:00
tcp_ulp.c	tcp: fix out-of-bounds access in ULP sysctl	2017-06-23 14:10:05 -04:00
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c	tcp_westwood: use tcp_jiffies32 instead of tcp_time_stamp	2017-05-17 16:06:01 -04:00
tcp_yeah.c
tcp.c	bpf: Add support for changing congestion control	2017-07-01 16:15:14 -07:00
tunnel4.c
udp_diag.c	net: convert sock.sk_refcnt from atomic_t to refcount_t	2017-07-01 07:39:08 -07:00
udp_impl.h	udp: make *udp*_queue_rcv_skb() functions static	2017-05-18 10:23:33 -04:00
udp_offload.c	udp: disable inner UDP checksum offloads in IPsec case	2017-04-24 13:48:54 -04:00
udp_tunnel.c
udp.c	udp: preserve skb->dst if required for IP options processing	2017-07-18 12:00:13 -07:00
udplite.c
xfrm4_input.c
xfrm4_mode_beet.c	networking: make skb_pull & friends return void pointers	2017-06-16 11:48:39 -04:00
xfrm4_mode_transport.c	xfrm: Add encapsulation header offsets while SKB is not encrypted	2017-04-14 10:07:39 +02:00
xfrm4_mode_tunnel.c	xfrm: Add encapsulation header offsets while SKB is not encrypted	2017-04-14 10:07:39 +02:00
xfrm4_output.c	xfrm: Add an IPsec hardware offloading API	2017-04-14 10:06:10 +02:00
xfrm4_policy.c
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c